Debug logging in OpenAPI provider can expose auth headers

[jlowin]

In `src/fastmcp/server/providers/openapi/components.py` line 186, debug logging includes the full request headers:

```python
logger.debug(f"run - sending request; headers: {request.headers}")
```

This logs auth headers (Authorization, X-API-Key, etc.) in plaintext at debug level. While debug logging isn't enabled by default, debug logs are often captured in production logging systems and can leak credentials.

Fix: Redact sensitive headers before logging:

```python
SENSITIVE_HEADERS = {"authorization", "x-api-key", "cookie", "proxy-authorization"}

def _redact_headers(headers):
return {
k: "***" if k.lower() in SENSITIVE_HEADERS else v
for k, v in headers.items()
}

logger.debug(f"run - sending request; headers: {_redact_headers(request.headers)}")
```

[marvin-context-protocol]

Claude finished @jlowin's task in 59s —— View job

---

Triage Summary

The issue is confirmed. A single debug log statement at components.py:186 dumps all request headers — including Authorization, X-API-Key, and any other sensitive headers — in plaintext.

• Gather context on OpenAPI provider HTTP logging
• Identify all locations where headers may be logged
• Formulate recommendation and action plan

Recommendation

Add a small _redact_headers helper in components.py and use it in the one offending log line. The fix is a ~15-line change in a single file.

Findings

Affected line: src/fastmcp/server/providers/openapi/components.py:186

logger.debug(f"run - sending request; headers: {request.headers}")

This is the only location in the OpenAPI provider that logs headers. The OpenAPIResource.read method (line ~290-301) also constructs headers from self._client.headers and MCP headers, but does not log them.

No existing redaction or sanitization utilities exist in the codebase for HTTP headers.

Detailed Action Plan

1. Add a _redact_headers helper function near the top of src/fastmcp/server/providers/openapi/components.py (after imports):

_SENSITIVE_HEADER_NAMES = frozenset({
    "authorization",
    "proxy-authorization",
    "x-api-key",
    "cookie",
    "set-cookie",
})


def _redact_headers(headers: httpx.Headers | dict[str, str]) -> dict[str, str]:
    """Return a copy of headers with sensitive values replaced by '***'."""
    return {
        k: "***" if k.lower() in _SENSITIVE_HEADER_NAMES else v
        for k, v in headers.items()
    }

2. Update the log line at line 186:

# Before
logger.debug(f"run - sending request; headers: {request.headers}")

# After
logger.debug(f"run - sending request; headers: {_redact_headers(request.headers)}")

3. Add a test in the appropriate OpenAPI test file to verify that the redaction helper works correctly:

• Confirm Authorization, X-API-Key, Cookie, Proxy-Authorization values are replaced with ***
• Confirm non-sensitive headers (e.g., Content-Type, Accept) are passed through unchanged

Related Files

Repository	File	Relevance	Sections
PrefectHQ/fastmcp	components.py	Contains the offending log line and is the only file that needs modification	186

---

Marvin Context Protocol | Type /marvin to interact further

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[nightcityblade]

Hi, I'd like to work on this. I'll submit a PR shortly.

[jlowin]

@nightcityblade always great to jump in, sorry I'm in the middle of a huge burst of PRs here. Though note I had already opened a PR when you indicated you wanted to work on this, so watch out for duplicate work please!